M&T Bank Data Breach: Sensitive Personal Information Exposed

M&T Bank, a community-focused bank serving more than 3.6 million customers across 12 states and Washington, D.C., disclosed a data breach connected to a security incident at a third-party law firm, Gelinas & Ward LLP. The incident occurred in August 2025 and involved the exposure of sensitive customer information including Social Security numbers and financial account details.

M&T Bank stated that as soon as it learned certain files containing customer personal information may have been involved, it began a comprehensive review and worked closely with the provider to assess the situation, understand its scope, and determine what data was affected.

The bank confirmed that the incident occurred entirely within the third-party law firm's environment and that M&T Bank's own systems were not affected.

The types of personal information that may have been exposed include names, Social Security numbers, credit and debit card numbers, driver's license numbers and financial account information.

The breach was first reported to the Massachusetts Office of Consumer Affairs and Business Regulation, with 462 Massachusetts residents identified as affected. The total number of individuals affected across the United States has not been disclosed.

M&T Bank sent notification letters to affected customers on April 17, 2026.

M&T Bank's response to the breach

M&T Bank is offering affected customers 24 months of complimentary credit monitoring through Equifax Complete Premier.

To enroll, customers can visit Equifax's activation page and enter the unique activation code included in their notification letter. The code is valid for 90 days from the date the letter was issued.

Separately, Gelinas & Ward is offering affected individuals 24 months of credit monitoring and identity theft restoration services through TransUnion.

For questions, M&T Bank has set up a dedicated phone line at 1-800-724-2440, available Monday through Friday from 6 a.m. to 9 p.m. and Saturday and Sunday from 9 a.m. to 5 p.m. Eastern Time.

Gelinas & Ward can be reached by mail at 106 Merriam Ave., Leominster, MA 01453.